PT-2026-113714

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat issues top.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...